Monitoring Network Traffic With IPTraf

IPTraf is a very useful ncurses-based application that shows the traffic passing through your machine.

On startup, you can immediately see all network traffic on your machine by choosing "IP traffic monitor." The configuration menu enables you to change the logging interval (under Timers) or add monitoring of ports above 1023, as these aren't monitored by default. You can also turn on DNS lookups and service name lookups to get names rather than numbers.

One of the best points of iptraf is its flexible traffic-filtering options. In the Add Filters screen, the left-hand set of filters are for the source address; the right-hand for the destination. A value of 0.0.0.0 for IP address and netmask translates to "all hosts." The I/E at the bottom control whether matching data is included or excluded.

An important point is that iptraf interprets filters to mean "include/exclude this data, and show nothing else." For including data, this works fine. But if you exclude a particular set of data, that data won't be shown; nor will any other data. You must add a second filter, which has both sets of address and mask as 0.0.0.0, and that has "Y" by all the protocols, to show the rest of the traffic. Filters are applied in order, so this general filter must be the last in the chain.

After you've defined the filter, you need to use the "Apply filter" option from the Filters - IP menu, before using the display again to examine the data you want.

This article was first published on ServerWatch.com.